Grafana — свободная программная система визуализации данных, ориентированная на данные систем ИТ-мониторинга.
Релизный цикл, информация об уязвимостях
График релизов
Количество 380
GHSA-q99m-qcv4-fpm7
Grafana Command Injection And Local File Inclusion Via Sql Expressions
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the eva ...
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
BDU:2024-07696
Уязвимость реализации прикладного программного интерфейса Endpoint платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю повысить свои привилегии
BDU:2024-08254
Уязвимость функции Expressions платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код
BDU:2024-09900
Уязвимость функции Organizations платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю повысить свои привилегии
GHSA-p978-56hq-r492
Grafana folders admin only permission privilege escalation
GHSA-x744-mm8v-vpgr
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
GHSA-gj7m-853r-289r
Grafana when using email as a username can block other users from signing in
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-q99m-qcv4-fpm7 Grafana Command Injection And Local File Inclusion Via Sql Expressions | CVSS3: 9.9 | 92% Критический | 8 месяцев назад |
| CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the eva ... | CVSS3: 9.9 | 92% Критический | 8 месяцев назад |
 | CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | CVSS3: 9.9 | 92% Критический | 8 месяцев назад |
 | CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | CVSS3: 9.9 | 92% Критический | 8 месяцев назад |
 | BDU:2024-07696 Уязвимость реализации прикладного программного интерфейса Endpoint платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю повысить свои привилегии | CVSS3: 4.1 | 0% Низкий | 9 месяцев назад |
| BDU:2024-08254 Уязвимость функции Expressions платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.9 | 92% Критический | 9 месяцев назад |
| BDU:2024-09900 Уязвимость функции Organizations платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю повысить свои привилегии | CVSS3: 4.2 | 0% Низкий | 10 месяцев назад |
| GHSA-p978-56hq-r492 Grafana folders admin only permission privilege escalation | CVSS3: 7.6 | 0% Низкий | около 1 года назад |
| GHSA-x744-mm8v-vpgr Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins | CVSS3: 6.8 | 0% Низкий | около 1 года назад |
| GHSA-gj7m-853r-289r Grafana when using email as a username can block other users from signing in | CVSS3: 4.3 | 0% Низкий | около 1 года назад |
Уязвимостей на страницу